Using Threat Feed for Ad-blocking in FortiOS
IMPORTANT: As of January 1st, 2024, OISDN.NL is no longer providing support for HOST and DOMAIN name listings.
This tutorial is meant to guide you into setting up a threat feed on a FortiGate to block threat sources via DNS Filter.
1. Add External Connector (external-resource
) to the Feed
GUI
Using the GUI, navigate to External Connectors
, create a new Domain Name
Threat Feed:
Name
: EmberStack Domain Threat Feed
URL
: https://dbl.oisd.nl/basic/
HTTP basic authentication
: Disabled
Refresh Rate
: 60
Status
: Enabled
CLI
Using the CLI (web management or SSH)
config system external-resource
edit "OSID DNS Basic Domain Threat Feed"
set type domain
set category 193
set resource "https://dbl.oisd.nl/basic/"
set refresh-rate 60
next
end
2. Configure DNS Filter Profile
GUI
Using the GUI, navigate to Security Profiles
->DNS Filter
. Select the profile you want to edit (if you have multiple profiles enabled).
Enable FortiGuard Category Based Filter
and in the table, under the category Remote Categories
find OSID DNS Basic Domain Threat Feed
. Set this to Redirect to Block Portal
. Repeat this for other feeds for a more comprehensive ad-block solution.
CLI
Using the CLI (web management or SSH)
config dnsfilter profile
edit "default" << ---- edit the profile you want
config ftgd-dns
config filters
edit 1 << ---- edit a new entry
set category 193 << ---- the feed category from step 1
set action block
next
end
end
end
end
3. Set up DNS Server to use DNS Filter profile
GUI
Using the GUI make sure you have DNS Database
feature enabled under System
-> Feature Visibility
.
Navigate to Network
-> DNS Servers
.
Create a new DNS Service on Interface
(for example for internal
) or edit an existing one. Enable DNS Filter
and select the profile you configured (if you have multiple profiles enabled).
CLI
Using the CLI (web management or SSH):
config system dns-database
edit "internal"
...
set dnsfilter-profile "<your filter or default>"
next
end